starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-24 21:36:01 +03:00

[PR #2529] fix(security): add authentication to file upload and presigned URL endpoints #2369

New issue

Open

opened 2026-02-26 20:33:34 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 20:33:34 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/documenso/documenso/pull/2529
Author: @elweb-3
Created: 2/22/2026
Status: 🔄 Open

Base: main ← Head: bounty/issue-2492

📝 Commits (1)

2aa78fd fix(security): add authentication to file upload and presigned URL endpoints

📊 Changes

4 files changed (+78 additions, -19 deletions)

View changed files

📝 apps/remix/app/routes/embed+/v1+/authoring+/document.create.tsx (+11 -6)
📝 apps/remix/app/routes/embed+/v1+/authoring+/template.create.tsx (+11 -6)
📝 apps/remix/server/api/files/files.ts (+36 -0)
📝 packages/lib/universal/upload/put-file.ts (+20 -7)

📄 Description

Summary

Fixes #2492

The POST /api/files/upload-pdf and POST /api/files/presigned-post-url endpoints lacked any form of authentication, allowing unauthenticated users to:

Upload arbitrary PDF files to storage (database or S3)
Generate S3 presigned URLs without credentials

This could lead to storage exhaustion, S3 bucket pollution, database pollution, and cost amplification (CVSS 7.5 High).

Changes

`apps/remix/server/api/files/files.ts`

Added authentication checks to both upload-pdf and presigned-post-url POST handlers
Supports two authentication methods (matching the pattern used by existing GET endpoints):
1. Session cookie — for authenticated webapp users
2. Embedding presign token (via Authorization: Bearer <token> header) — for embedding authoring flows
Returns 401 Unauthorized when neither authentication method is present

`packages/lib/universal/upload/put-file.ts`

Updated putPdfFile, putFile, and putFileInS3 to accept an optional { token } parameter
When provided, the token is sent as a Bearer authorization header with file upload requests

`apps/remix/app/routes/embed+/v1+/authoring+/document.create.tsx`

`apps/remix/app/routes/embed+/v1+/authoring+/template.create.tsx`

Extract the embedding presign token from URL search params
Pass it to putPdfFile() so embedding authoring flows continue to work with the new authentication requirement

Testing

Unauthenticated POST /api/files/upload-pdf → 401
Unauthenticated POST /api/files/presigned-post-url → 401
Authenticated (session cookie) upload → works as before
Embedding authoring flow (presign token) → works as before

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/documenso/documenso/pull/2529 **Author:** [@elweb-3](https://github.com/elweb-3) **Created:** 2/22/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `bounty/issue-2492` --- ### 📝 Commits (1) - [`2aa78fd`](https://github.com/documenso/documenso/commit/2aa78fdf5882676f3f7d13e284c480349fdb0b3c) fix(security): add authentication to file upload and presigned URL endpoints ### 📊 Changes **4 files changed** (+78 additions, -19 deletions) <details> <summary>View changed files</summary> 📝 `apps/remix/app/routes/embed+/v1+/authoring+/document.create.tsx` (+11 -6) 📝 `apps/remix/app/routes/embed+/v1+/authoring+/template.create.tsx` (+11 -6) 📝 `apps/remix/server/api/files/files.ts` (+36 -0) 📝 `packages/lib/universal/upload/put-file.ts` (+20 -7) </details> ### 📄 Description ## Summary Fixes #2492 The `POST /api/files/upload-pdf` and `POST /api/files/presigned-post-url` endpoints lacked any form of authentication, allowing unauthenticated users to: - Upload arbitrary PDF files to storage (database or S3) - Generate S3 presigned URLs without credentials This could lead to **storage exhaustion**, **S3 bucket pollution**, **database pollution**, and **cost amplification** (CVSS 7.5 High). ## Changes ### `apps/remix/server/api/files/files.ts` - Added authentication checks to both `upload-pdf` and `presigned-post-url` POST handlers - Supports two authentication methods (matching the pattern used by existing GET endpoints): 1. **Session cookie** — for authenticated webapp users 2. **Embedding presign token** (via `Authorization: Bearer <token>` header) — for embedding authoring flows - Returns `401 Unauthorized` when neither authentication method is present ### `packages/lib/universal/upload/put-file.ts` - Updated `putPdfFile`, `putFile`, and `putFileInS3` to accept an optional `{ token }` parameter - When provided, the token is sent as a `Bearer` authorization header with file upload requests ### `apps/remix/app/routes/embed+/v1+/authoring+/document.create.tsx` ### `apps/remix/app/routes/embed+/v1+/authoring+/template.create.tsx` - Extract the embedding presign token from URL search params - Pass it to `putPdfFile()` so embedding authoring flows continue to work with the new authentication requirement ## Testing - Unauthenticated `POST /api/files/upload-pdf` → 401 - Unauthenticated `POST /api/files/presigned-post-url` → 401 - Authenticated (session cookie) upload → works as before - Embedding authoring flow (presign token) → works as before --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem added the

pull-request

label

2026-02-26 20:33:34 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#2369

No description provided.

Rows
Columns